tiangong-kb-course-fulltext-fetch

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but it relies on a mutable `npx @latest` CLI and forwards AWS credentials to that external CLI with only partial provenance evidence. This is better classified as medium supply-chain and credential-handling risk than confirmed malicious behavior.

This Bash wrapper does not itself show overt malware behavior (no eval/dynamic code execution, no hardcoded secrets, no direct exfiltration). However, it has meaningful security exposure: it executes a runtime-resolved `npx @tiangong-ai/cli@latest` by default (supply-chain risk) and can execute an attacker-chosen command via TIANGONG_AI_CLI/TIANGONG_AI_CLI_BIN (execution control via environment). Additionally, it can load and export values from a user-specified env_file into the child process environment and can overwrite user-chosen output paths. Treat this wrapper as high-risk in untrusted/CI multi-tenant contexts and mitigate by pinning/verifying the CLI dependency and restricting env/output control.